

NASA Technical Memorandum 84920 

NASA-TM-84920 19840007091 


AFTI/F-16 Flight Test Results and 
Lessons 

Steven D. Ishmael and Capt. Donald R. McMonagle 


October 1983 


LIBRARY COPY 


NASA 

National Aeronautics and 
Space Administration 


JAN 5 1 1984 

LANGLEY RESEARCH CENTER 
LIBRARY, NASA 
HAMPTON t VIRGINIA 






NASA Technical Memorandum 84920 


AFTI/F-16 Flight Test Results and 

Lessons 


Steven D. Ishmael and Capt. Donald R. McMonagle 

NASA Ames Research Center, Dryden Flight Research Facility, Edwards, California 93523 


f\JA5A 

National Aeronautics and 
Space Administration 
Ames Research Center 
Dryden Flight Research Facility 
Edwards, California 93523 






AFTI/F-16 FLIGHT TEST RESULTS AND LESSONS 


Mr. Stephen D. Ishmael (M) 
NASA Ames Research Center 
Dryden Flight Research Facility 

and 

Capt. Donald R. McMonagle, USAF (M) 
Air Force Flight Test Center 


INTRODUCTION 


The Advanced Fighter Technology Integration (AFTI)/F-16 
Program is a technology development effort managed by the 
Advanced Development Program Office (ADPO), Flight Dynamics 
Laboratory (FDL), Air Force Wright Aeronautical Laboratories 
( AFWAL ) , Wright-Patterson AFB , Ohio. The overall objectives 
of this joint Air Force, NASA, Navy, and General Dynamics 
Corp. program are to develop and demonstrate technologies 
and alternatives for future fighter aircraft design. These 
objectives are to be accomplished in several phases. This 
paper addresses the results of the first phase — the digital 
flight control system (DFCS). 

The digital flight control system phase consisted of the 
development and flight testing of a triplex, asynchronous, 
multimode, digital flight control system which was inte- 
grated with improved avionics. Flight testing was conducted 
by the AFTI/F-16 Joint Test Force from the Dryden Flight 
Research Facility at Edwards AFB, California, from July 10, 
1982, through July 30, 1983. A total of 118 flight test 
sorties were flown, totaling 177.2 flight hours. 

This paper summarizes the flight test program and 
addresses several design issues of general interest. The 
paper begins with a brief description of the test vehicle, 
its flight control modes, and the flight envelopes in which 
testing was accomplished. It further summarizes flight test 
results by addressing benefits experienced in flight control 
task-tailoring, handling qualities in mission tasks, air- 
craft structure considerations, digital flight control sys- 
tem performance, and human factors. The last section 
addresses several design issues relevant to future fighter 
aircraft . 



THE TEST AIRCRAFT 


The AFTl/F-16 is a modified full-scale development 
NF-16A aircraft. Modifications included incorporation of an 
asynchronous operation, triplex digital flight control sys- 
tem, which provided multiple in-flight-selectable flight 
control laws, including six-degree-of-f reedom decoupled air- 
craft motions. Twin canards were mounted from actuators in 
each side of the lower lip of the engine inlet, 15° off the 
vertical. A fuselage dorsal fairing was added to provide 
room for test instrumentation and additional avionics. New 
and modified cockpit controls and displays included a rede- 
signed sidestick controller incorporating eight switches, a 
linear motion throttle with a twist action controller for 
vertical decoupled motion, a conventional optics wide-field- 
of-view head-up display, two multipurpose display cathode 
ray tubes, and a voice command system providing voice actua- 
tion of selected cockpit switches. 

Eight distinct cockpit-selectable control laws were 
implemented with the digital flight control system. Each 
set of control laws (control modes) was "task-tailored" for 
the intended mission. Decoupled control motions were 
included with selected control modes, as shown in table 1. 

Each of the decoupled-mode pitch axes was implemented 
with a "maneuver enhancement" version of the corresponding 
standard-mode pitch-axis command mechanization. Maneuver 
enhancement was accomplished by tailoring symmetrical flap- 
eron and horizontal tail motions to achieve the desired 
pitch response. Trailing-edge flaperon motion was designed 
to minimize steady-state drag at a given flight condition 
(scheduled flaps), while simultaneously quickening g res- 
ponse or improving tracking (maneuvering flaps). Maneuvering 
flaps were optimized for either flightpath maneuver enhance- 
ment (FPME) or pitch-rate maneuver enhancement (PRME). 

The pitch axis of the decoupled air-to-air mode was a 
unique mechanization of variable gains. Pitch command gains 
varied as a function of the pitch-rate error signal (comman- 
ded versus actual). For large changes in pitch command, 
command gains were increased to improve pitch-rate and load- 
factor response. Desirable fine-tracking handling qualities 
were to be achieved with lower command gains for smaller 
pitch command changes. 

Six-degree-of-f reedom decoupled motions were produced by 
combined deflections of two similarly oriented control sur- 
faces (fig. 1). In the vertical axis, combined deflections 
of flaperons and horizontal tails were used with different 
control laws to produce decoupled direct lift, pitch point- 
ing, or vertical translation (fig. 2). Vertical decoupled 
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motions were controlled using the throttle twist controller. 
Combined deflections of vertical canards and rudder were 
used with different control laws to produce the directional 
decoupled motions of direct sideforce (flat turn), yaw 
pointing, and lateral translation (fig. 3). Rolling moments 
produced by directional control surface deflections were 
countered by roll control surfaces to provide directional 
decoupling. Directional decoupled motions were controlled 
on the conventional rudder pedals. 

Figures 4 and 5 show the final flight envelopes achieved 
for handling qualities evaluations. During preliminary 
evaluations, it was determined that, except for the standard 
normal control mode, the decoupled control modes showed more 
potential for improved mission performance. Envelope expan- 
sions of the standard modes for bombs, air-to-air guns, and 
air-to-surf ace guns were discontinued at that time. 

Although there was often more than one set of control laws 
implemented and evaluated in the AFTl/F-16 for each mission 
task, only the results of the "best" control laws evaluated 
are reported in this paper. 


FLIGHT TEST RESULTS 


Task Tailoring 

The effort to optimize control laws for individual mis- 
sion tasks was highly successful. Using the production F-16 
aircraft as a baseline for comparison, pilots cited marked 
improvements in handling qualities for nearly all tasks. 
These tasks included air-to-air and air-to-ground missions, 
as well as formation flying and approach and landing. It 
was apparent that the control laws had been developed with 
accurate prioritization of the control parameters used for 
individual mission tasks. 

In the process of identifying the "best" control laws 
for each task, it became clear that control law optimization 
for one task did not carry over to another task. During 
preliminary evaluations, several control laws were investi- 
gated for potential utility. Many control laws were eval- 
uated intentionally for tasks for which they were not 
designed. In every case, the task-tailored control law was 
identified as having superior handling qualities for that 
task. In many cases, the converse was also true. Task- 
tailored control laws often demonstrated unacceptable 
handling qualities in tasks for which they were not 
tailored . 

The full benefits of task tailoring could not have been 
realized without multiple control modes. Handling qualities 
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improvements over the production F-16 aircraft in nearly all 
tasks indicated that significant benefits are to be gained 
in the task-tailoring approach. Handling qualities improve- 
ments were, however, associated with distinct control modes, 
and each of these control modes demonstrated less desirable 
handling qualities in tasks for which they were not tail- 
ored. This indicated that a single control mode could not 
have been tailored for multiple missions without compromis- 
ing handling qualities for some or all of the mission tasks. 


Air-to-Air Handling Qualities 

The decoupled air-to-air flight control mode employed 
pitch-rate maneuver enhancement tailored to facilitate air- 
to-air weapon delivery. The mode exhibited superior nose- 
pointing capability, reliable predictability, and precise 
small-amplitude high-frequency control. Although the con- 
cept of weighting feedback variables, such as load factor 
and pitch rate, was not new, it appeared to offer consistent 
improvement over simpler control law structures. The basic 
control law concept employed in the air-to-air task-tailored 
control law suggested generic structure which should be 
observed by any fighter. 

The differential weighting of pitch rate as a function 
of pitch-rate error attempted to address the requirement of 
large tracking errors for immediate movement of the flight- 
path vector, which requires significant overshoot of pitch 
rate. Small errors, however, necessitate high-frequency 
attitude adjustments and are more closely controlled with 
minimum pitch-rate overshoot. The AFTI/F-16 air-to-air 
control law attempted to infer which type of tracking error 
existed by categorizing feedback pitch-rate error. Regard- 
less of the variable used to deduce the magnitude of the 
tracking error, the capability to switch between the two 
pitch-rate responses suggested that the AFTl/F-16 aircraft 
is a paradigm for any fighter when judged from the flying 
qualities point of view. 

The decoupled capabilities of pitch and yaw pointing did 
not demonstrate the same unequivocal utility as the longitu- 
dinal coupled control law. Although difficult to ascertain 
when pitch -pointing authority was saturated, the mode 
appeared quite controllable in terms of response rise time, 
linear movement and small overshoot of final position. Con- 
trollability notwithstanding, target tracking handling qual- 
ities were not improved over sole use of coupled longitudi- 
nal control on the conventional sidestick. For small cor- 
rections, yaw pointing permitted better azimuth error 
correction than lateral stick only. Limited pointing and 
yaw-rate authorities restricted its use for larger correc- 
tions and higher line-of-s ight-rate targets typical of 
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high-aspect gunnery (table 2). Pedal forces were rather 
high for a vernier controller. Bank attitude became harder 
to control with larger yaw-pointing angles. It was occa- 
sionally difficult to avoid overcontrol in the lateral axis, 
expecially for small, quick inputs with large aft stick 
inputs. Yaw pointing appeared to obviate this lateral dif- 
ficulty and represented its chief advantage. 


Air-to-Ground Handling Qualities 

Flightpath maneuver enhancement was incorporated in the 
decoupled bombs control mode to improve precision in flight- 
path control and alleviate gust upset. An additional fea- 
ture of automatic trim compensation relieved the pilot from 
having to make trim corrections for pitch-attitude changes 
(dive angle) and for airspeed changes (zero speed stabil- 
ity). The result was excellent air-to-ground and strafe 
pipper stability, precise control, and improved ride qual- 
ity. All combined to reduce pilot workload and improve 
mission performance. 

The primary decoupled motions evaluated for the air-to- 
ground tasks were flat turn and direct lift. Although 
smooth and precise air-to-ground tracking corrections could 
be made using direct lift on the throttle twist controller, 
the same task could be accomplished equally well using only 
coupled longitudinal control on the conventional sidestick. 
The use of flat turn in the bombing and strafing tasks pro- 
vided the significant advantage of reducing the directional 
correction problem from two control axes to one. Conven- 
tional control requires use of the roll and pitch axis to 
make directional corrections. Often the dynamics of bomb 
fall lines, pendulum effects, and/or gravity drop (strafe 
pippers) cause unpredictability in pipper motion while mak- 
ing corrections using the roll axis. Flat turn eliminated 
that unpredictability by allowing corrections to be made 
using a direct pipper tracking path to the target. The 
result was a quicker and more accurate weapon solution. 


Handling Qualities in Formation 

The standard normal mode was intended for use in naviga- 
tion and formation flying tasks. Handling qualities were 
satisfactory for small pitch inputs generally representative 
of aerial refueling and mild maneuvering in close formation. 
Pilots preferred the aerial refueling handling qualities of 
the AFTI/F-16 aircraft over the production F-16 aircraft, 
primarily because of a perceived improvement in open-loop 
pitch stability. For larger pitch inputs, however, a some- 
what unpredictable response was discovered which the pilots 
described as a vertical "heaving." 
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This description of aircraft motion suggests that the 
blended motion of trailing-edge flaps in this mode may have 
been responsible for the undesirable response. In close 
formation, relative change in pitch attitude may be a more 
precise pilot cue for position control than load factor. 

The use of maneuvering flaps to increase weighting of load 
factor in pitch response may lead to unpredictability in 
formation flying. 

Translations were primarily evaluated for close- 
formation and aerial refueling tasks. The mechanization of 
lateral and vertical translation gave the pilot acceleration 
controllers and was found to be peculiar. With any input, 
the pilot was commanding an acceleration and, when released, 
a deceleration. Mechanization with translation rate control 
would have been more intuitive. The control surface deflec- 
tion for vertical translation produced considerable drag, 
which complicated the fore and aft positioning task. The 
vertical positioning task was more easily accomplished using 
coupled longitudinal control on the conventional sidestick. 
It was projected that, with a rate controller, lateral 
translation could offer benefits in the aerial refueling 
task . 


Approach and Landing Handling Qualities 

Handling qualities of the AFTI/F-16 aircraft during 
approach and landing were significantly better than those of 
the production F-16 aircraft. The pitch-rate command system 
provided precise pitch-attitude control with exceptional 
hands-off pitch stability. With reduced workload in pitch- 
attitude control, pilots perceived correlated improvements 
in flightpath and angle-of-attack stability. The overall 
result was improved aircraft control and landing perfor- 
mance . 


These improvements were apparent for both front-side and 
back-side control techniques. When flying the front-side 
technique, for which flightpath was the primary control 
parameter, precise pitch attitude control reduced effort 
spent in establishing and maintaining flight path leaving 
more time for control of airspeed and angle-of-attack using 
the throttle. Using the back-side technique, for which 
angle-of-attack was the primary control parameter, pitch 
attitude stability tended to reduce angle-of-attack varia- 
tion allowing more time for control of flight path control 
using power. The Navy project pilot conducted a comparative 
evaluation of carrier approach handling qualities between 
the AFTl/F-16 and the production F-16 aircraft. From this 
high gain back-side technique evaluation, he concluded that 
the AFTI/F-16 demonstrated better handling qualities. 
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Degraded Modes 


An analog independent backup unit flight control system 
was incorporated in the AFTI/F-16 aircraft to offer a safe 
recovery capability in the event of generic digital flight 
control system failures. Although the backup unit was 
tested throughout the Mach-altitude envelope of the digital 
flight control system, testing was limited to benign maneu- 
vering. No high-angle-of-attack testing or landings were 
accomplished in the backup mode. The independent backup unit 
performed as it was designed, and flight test results 
matched well with simulation. The only significant discre- 
pancy was a tendency for lateral-directional pilot-induced 
oscillation at Mach 1.2 and 30,000 ft. 

The AFTI/F-16 digital flight control system architecture 
included control law reconfigurations for complete loss of 
certain types of sensor information. These seven recon- 
figuration control laws were not tested in flight. 


Structures 

Flight testing demonstrated the advantages of digital 
flight control systems for exploiting aircraft structure 
envelopes. Without expensive or complicated analog or mech- 
anical systems, the flight control law gain structure essen- 
tially "mapped" the structural capability of the aircraft by 
limiting surface motions as a function of flight condition. 
Performance was improved by taking advantage of that struc- 
tural capability over a large portion of the flight enve- 
lope. This did, however, significantly increase the flight 
test matrix since there was no one "worst case" flight con- 
dition below which structural loads could be assumed accep- 
table. Where flight test loads did not match predicted 
loads, changes could be made in software (instead of making 
expensive hardware changes) to improve structural "mapping." 

The predictions for structural loads during unique 
decoupled motions were inadequate. Decoupled maneuvers pro- 
duced horizontal tail loads and vertical tail support struc- 
ture loads which were higher than predicted. This required 
not only control law changes, but modification to the ver- 
tical tail support structure and further horizontal tail 
static testing to verify the adequacy of the structures 
without reducing aircraft performance. These higher-than- 
predicted loads indicated the need for improved structural 
design techniques for decoupled motions. 


Digital Flight Control System Performance 


In the course of 118 test sorties, a total of 38 in- 
flight fault declarations were annunciated by the digital 
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flight control system (table 3). At no time did the system 
automatically degrade to either a reconfiguration mode or 
the analog independent backup unit. All of these fault dec- 
larations occurred during periods of system development and 
flying qualities envelope expansion. No anomalies occurred 
during dedicated handling qualities evaluation flights. 

This performance indicated that, like hardware, a software 
envelope can be established in which continued reliable 
operation can be expected. 

During less than 13 months of flight testing, there were 
13 DFCS operational flight program (OFP) software releases 
(Fig. 6). These incorporated 129 changes, involving approxi- 
mately 12,000 words of computer code. 


Human Factors 

The AFTI/F-16 program has addressed several new issues 
and techniques for improving the pilot's ability not only to 
fly but also to manage a fighter weapons system. Among 
others were the questions of (1) mechanization of flight 
controllers for decoupled motions, (2) improved pilot- 
vehicle-interface (PVI) avionics, (3) mission phase switcho- 
logy for easy transition between mission tasks, and (4) 
introduction of voice-commanded switch actuations. 

A fair handling qualities evaluation of decoupled 
motions demands that flight controllers be mechanized to be 
intuitive and to maximize positive transfer of previously 
learned skills. Use of the rudder pedals for control of 
directional decoupled motions was successful. Indeed, by 
the end of the flight test program, pilots found themselves 
unconsciously applying flat turns in the bombing task when 
it was not required to meet the objectives of the test 
maneuver . 

This transfer was not as successful, however, with the 
throttle twist controller for vertical decoupled motions. 

The problem was compounded in that, unlike the rudder 
pedals, conventional control on the pitch stick could not be 
replaced with decoupled motion and retain gross maneuvering 
capability. The result was implementation of two control- 
lers that provided simultaneous control in similar (vertical 
and/or pitch) axes. Recognizing that the decoupled motions 
controlled on the throttle twist were designed for small 
vernier corrections, vertical decoupled motions were eva- 
luated with the pilot consciously attempting to make small, 
high-frequency corrections using the throttle twist control- 
ler, while attempting to make larger amplitude, lower fre- 
quency corrections using the conventional sidestick. The 
results were discouraging in that pilots encountered diffi- 
culty in recognizing approaching saturation of left-hand 
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decoupled motions and integrating the saturation away with 
the right hand. There was also some indication that right- 
handed pilots tended to use their left hand less actively 
for high-gain tracking corrections than did the left-handed 
pilot (one of the five project pilots was left-handed). It 
was concluded that the use of two controllers in similar 
axes for the same task only increased workload and did not 
improve task performance. Each task could be accomplished 
just as well (if not better) using only the conventional 
sidestick controller. 

Improvements in pi lot-vehicle-interface avionics were 
beneficial and considered necessary for management of 
sophisticated aircraft systems. With multiple complex air- 
craft systems, such as multimode flight control systems, 
multimode radar, threat warning, and a variety of stores and 
stores management options, efficiency in displays and pilot 
interface becomes essential for keeping workload at a toler- 
able level. Two multipurpose displays (with integrated . 
switchology for systems interface) and a conventional 
optics, wide-f ield-of-view (instantaneous 15° x 20° (total 
25°) for AFT I/F-16 , versus 9° x 13° (total 20°)) for pro- 
duction F-16) head-up display provided that interface capa- 
bility. Of particular benefit was the capability to display 
flight control system fault status. Although mechanization 
and display symbology warranted improvement, the pilot was 
offered detailed information on the "health" of the digital 
flight control system. 

The transition between types of mission (such as from 
air combat to ground attack) was made very handily through 
mission phase switchology. Through a single switch action, 
the pilot could configure all the avionics systems and the 
flight control laws for the mission phase. This was con- 
sidered very beneficial since configuration of individual 
subsystems was cumbersome. 

The AFTl/F-16 program included the first developmental 
testing of a voice command system on a fighter aircraft. 

The system was flown on 87 test sorties and was tested by 
five pilots. Two independent contractors provided voice 
processors for flight testing. The objectives of the 
testing were to determine how word recognition rate was 
affected by (1) cockpit noise levels and (2) physiological 
stress produced by increased g loads. Of 4137 word recogni- 
tion attempts, 2615 were tests of varying noise conditions, 
1161 were tests of varying load factor conditions, and 361 
were in the active mode where pilots activated switchology 
by voice during mission tasks. These data were used to 
develop system recognition algorithms throughout the test 
program . 

Varying cockpit noise levels were produced by changes in 
airspeed and altitude conditions and environmental control 
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system settings (fig. 7). Tests were conducted at normal 
load factors from 1 to 5 . All quantitative tests were con- 
ducted with the pilot looking forward in the cockpit with no 
planned additional cockpit tasking. The systems were tested 
mainly in the verify mode where no actual cockpit switch 
actions were taken as a result of a recognized word. 

Test results are presented in figures 3 and 9. The 
overall recognition rate was 78 percent. These figures 
include all the data collected during flight tests. There- 
fore, they do not delineate improvements made in recognition 
algorithms and improvements in recognition rates as pilots 
became more familiar with the system. Results indicated 
that recognition rates were essentially independent of cock- 
pit noise levels and that there was only minor degradation 
with load factors up to 5. Brief qualitative evaluations of 
voice command systems indicated potential for workload 
reduction by use of voice command systems in fighter 
cockpits . 


DESIGN IMPLICATIONS 


Degraded Flight Control 

The AFTl/F-16 architecture reflects at least four design 
ramifications of general interest. The first issue examines 
transition between flight control mode. Highly augmented 
aircraft such as the F-16 rely on flight control system 
"intelligence" to inhibit aircraft responses. Indeed, the 
flight envelopes of all recent fighters are limited by their 
flight control systems. Unstable aircraft obviously require 
closed-loop feedback control to provide conventional stabi- 
lity and control. Increasing dependence on the flight 
control system to provide air-craft performance and safety 
requires classical tradeoff decisions when the system is 
mechanized with digital computers. 

Traditionally, software engineers have argued for 
simplicity in the generic software failure recovery mechani- 
zation. The IBU of the AFTl/F-16 aircraft generally follows 
guidelines for simplicity. In fact, the IBU was originally 
conceived with no pitch-rate feedback in the longitudinal 
axis. Even though the AFTl/F-16 aircraft is slightly 
unstable longitudinally, it was initially believed to be 
more important to keep the IBU simple than to minimize pilot 
control tasks. The emphasis on simplicity was generally 
motivated by the desire to maximize IBU reliability by mini- 
mizing complexity as well as the cost of covering a remote 
failure mode. The augmentation required by aircraft like 
the AFTl/F-16 encourages reexamination of the benefit of 
simple, degraded flight control modes such as the IBU. 
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The AFTl/F-16 aircraft requires angle-of-attack limiting 
to prevent post-departure deep stall. Simulation suggests 
that the IBU reduced capability to recover from spins or 
deep stalls. The automatic yaw-rate limiting of the primary 
flight control system renders the AFTl/F-16 extremely spin 
resistant. In the IBU, however, the simulation indicates 
that stopping yaw rate requires considerable altitude, thus 
suggesting a smaller envelope may be necessary for safe air- 
craft operation should the aircraft degrade to IBU. A simi- 
lar constraint has been encountered with the IBU at high 
airspeed. During aeroservoelastic testing, one pilot found 
insufficient lateral stability in IBU at Mach 1.2; there- 
fore, he reselected the standard normal mode and recommended 
not flying faster. Even though the AFTl/F-16 aircraft is 
longitudinally stable supersonically, selecting a single 
fixed gain for fighter aircraft such as the AFTl/F-16 over 
their entire flight envelope may not be possible. 

Analytically, there are at least two parts to the solu- 
tion of optimum tradeoff between degraded-mode complexity 
and envelope-protection capability. First, consider tran- 
sitioning from normal to degraded flight control. 

Transitions can be characterized by discontinuous step 
inputs or outputs. Additionally, the failures that cause 
transition are usually assumed to be random. The second 
part of degraded-mode flight addresses whether the flight 
can be successfully continued or what constraints must be 
observed during abort and recovery. 

The more difficult decisions occur with respect to tran- 
sition flight. Degraded modes in the AFTl/F-16 aircraft 
accommodate discontinuous inputs or outputs satisfactorily, 
and the techniques are generally known. The assumption that 
one could "drop" into IBU at any time, however, presents the 
possibility of some adverse events. Transition to IBU while 
flying a maximum angle of attack implies an unfortunately 
high probability of departure. Similarly, degrading to IBU 
at high airspeed suggests that the pilot must attempt to 
slow down in an unstable airframe pilot system. Under such 
circumstances the costs of simplicity in modes like the IBU 
are very high during random transitions to degraded flight 
control. Highly augmented aircraft such as the AFTI/F-16 
are penalized rather severely by simplicity in modes like 
the IBU during the relatively brief transition period. 
Development of the IBU reflected several compromises between 
simplicity and adequate coverage; Fig. 10 illustrates the 
significant increase in complexity of the final design as 
compared with the initial design. Degraded-mode simplicity 
is not sufficient justification when it prevents flight- 
envelope protection during the transition to backup flight 
control. After reversion to a backup mode, however, the 
lack of envelope limiting during mission abort is much less 
costly, because the pilot can be asked to constrain the 
aircraft to more benign conditions. 



For the case of AFTl/F-16 aircraft, angle-of-attack 
limiting would be beneficial, particularly during IBU tran- 
sition. Similarly, if a single fixed gain is not sufficient 
to provide acceptable stability over the entire envelope, 
the backup systems should include additional gains. 

Morever, the primary system should automatically update the 
appropriate backup gains for the current dynamic pressure 
conditions of the airplane. This provision would solve sta- 
bility problems associated with any fixed-gain system to 
which the aircraft can default at any time. It is not 
necessarily as important for the backup system to maintain 
equivalent envelope protection during mission abort and 
recovery. The pilot can be asked to constrain angle of 
attack to safe values during abort. Similarly, he can main- 
tain airspeeds and altitudes appropriate to a fixed-gain 
control mode such as the IBU. It is feasible to postulate 
several gains that a pilot could select as he decelerated 
and descended to land. The only constraint to maximizing 
opportunities for simplifying backup systems during the 
recovery phase is that pilot workload or distraction may 
prematurely require a minimum level of augmentation during 
the abort/recovery phase. The IBU included pitch-rate feed- 
back in partial response to cover pilot workload 
constraints . 


System Complexity 

A second architectural characteristic that significantly 
affected our experiences reflected the integrated nature of 
the system. The AFTl/F-16 is complex in terms of the number 
of system components and the permutations on component con- 
figuration. The large number of system configurations and 
their extensive interaction produce rather subtle conse- 
quences. It is frequently very difficult to explicitly know 
or test all the system effects of pilot actions in the real- 
time cockpit environment. Several discretes were required 
to indicate a specific component problem, and several com- 
ponents drove the same discrete. The AFTl/F-16 employs an 
architecture in which a single discrete may indicate 
multiple system conditions and, conversely, several discre- 
tes are often required to indicate a single system con- 
figuration or degradation. The multipurpose displays (MPDs) 
are frequently sequential interfaces with the flight control 
system, stores, or fire control computers where the pilot's 
eventual interaction with the system is a function of a 
series of key strokes whose system effects change based on 
the "page" displayed on the MPD at the time of option selec- 
tion. Frequently, a time history of failure annunciations 
is required to accurately identify a specific failed com- 
ponent. Although the AFTl/F-16 system is not stochastic, it 
is often no more clearly deterministic at the time one is 
trying to anticipate system response to pilot-controllable 
options . 
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Such a cockpit differs subtly from more traditional 
pilot-vehicle interfaces where system discretes are largely 
dedicated to single, fixed functions. For example, failure 
annunciator lights are usually dedicated to single component 
condition in more conventional cockpits. In the AFTl/F-16 
cockpit, those same lights may be used in combination with 
five-digit numerical fields on the MPD to indicate a speci- 
fic flight control system failure or configuration. The 
salient characteristic of a system with such configurational 
flexibility is that cause and effect is deduced from a set 
of multivalued system displays that both pass information to 
the pilot and represent pilot commands to the system. 

In the real-time cockpit environment where decisions are 
frequently required within a few minutes, it is often prob- 
lematical whether the plot has the information, total system 
knowledge, or time to analyze and consciously acknowledge 
all ramifications of his interaction with the operating 
system. The real-time decisionmaking constraints of systems 
sush as the AFTl/F-16 can be addressed by increasing the • 
dimensions of the pilot-vehicle interface with color presen- 
tations, audible tones, and voice actuation of system 
discretes. However, the systems still rely on the pilot to 
organize the system information, recognize inductive pat- 
terns in the system status, and deduce logical cause and 
effect relationships. The AFTl/F-16 may provide an early 
opportunity to evaluate "expert systems" in the real-time 
cockpit environment. A pi lot- vehicle interface constructed 
around an expert-system architecture avails itself of a fun- 
damental symbiosis. Human beings are unmatched pattern 
recognizers. Computers, their information structures, and 
certain mathematical algorithms have demonstrated equally 
peerless capability to search extensive graphs, trees, and 
other prestored lists. An expert system in the real-time 
cockpit of an aircraft like the AFTl/F-16 promises to use 
the strength of both pilot and computer. Not the least 
advantage of such a system would be its capability to par- 
tition decisions and system information into equivalent 
sets. Such partitioning would allow bounded decisions to be 
made without knowledge of the total system's response at the 
time of decision. Thus, expert systems may be powerful aids 
in solving the type of problems faced in the AFTl/F-16 real- 
time cockpit. 


Simplex Information in Redundant Systems 

A third ramification of system design that has proved 
interesting is the user's percepton of system reliability. 
The design goal of the AFTl/F-16 triple-redundant dual-fail- 
operate system required extraordinarily autonomous channels 
and a very powerful interchannel switching protocol to allow 
degradation to the last good channel. When the consequences 
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of asynchronism are summed with this intrasystem autonomy, 
the operating flight control system often appears as a 
series of partially autonomous components that compete for 
aircraft control. Much of the interchannel independence 
arises from both unsynchronized interchannel skew and the 
requisite intrasystem autonomy of a triplex dual-fail- 
operate system. 

It is important to distinguish the effects of asynchro- 
nism from last-good-channel operation. The AFTI F-16's 
asynchronous interchannel protocol created system states 
where single channels drove discretes and displays at the 
pilot-vehicle interface. Such simplex information is most 
important when it issues from the last good channel. 
Asynchronism, however, caused the display of false simplex 
channel information while the redundant set was still func- 
tional. Such annunciations diminish the perception that the 
system is highly reliable because it is composed of multiple 
identical channels — all doing the same "thing" — at least 
as long as there are no "real" faults in the system. 

Unfortunately, the disagreeable impact of this architec- 
ture on perceptions of reliability causes difficulty in 
measuring the advantages of the capability to degrade to the 
last good channel and to operate asynchronously. 

Interchannel comparison varies between the extremes of bit- 
by-bit comparison and force summing across the power ram of 
an actuator. Even though AFTl/F-16 computers do not expli- 
citly ascertain whether the other members of the operating 
set are performing the same operation, program development, 
nonetheless, shows continued localized synchronization. 
AFTl/F-16 channels do not employ dedicated hardware or soft- 
ware to communicate states to redundant channels and wait 
for acknowledgment; they "synchronize" by increasing 
interaction rates, or voting system states, or both. 
Interchannel differences are reduced by voting control law 
switch states, which control integrators and gains by 
interacting sufficiently fast or by exchanging status infor- 
mation in a timely fashion. As long as no errors exist, 
redundant systems cannot function reliably unless the impli- 
cit interchannel comparisons are sufficiently small to 
enable the system to behave as identical command paths. 

This requirement is independent of which synchronizing 
algorithms are used to achieve sufficient interchannel 
tracking. Furthermore, those same algorithms should not 
enable simplex information at the pilot-vehicle interface 
while a redundant set remains. 

A graphic example of how dramatically the perception of 
reliability can suffer from permitting simplex information 
at the pilot-vehicle interface while redundant channels 
remain occurred during flight test. Although no failure had 
occurred, the pilot received messages that two of the chan- 
nels had detected each other failed. With each channel in a 
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different state, the actuators eventually selected a com- 
mand. The pilot was unable to ascertain system configura- 
tion. It is important to recognize that the problem is not 
that the system failed to provide sufficient aircraft con- 
trol. Such inconsistent simplex information erodes users' 
perceptions that the redundant system is operating reliably 
and will continue to do so in future confusing failures. 

In summary, the AFTl/F-16 incorporates very powerful 
simplex channel capabilities to enable the system to degrade 
to the last good channel. Although the architecture 
retained this feature, reliability requirements, forced 
additional localized interchannel tracking by voting system 
states and increasing interaction rates. Regardless of 
asynchronism, or last-good-channel capability, displaying 
single-channel information with no failures in the redundant 
system diminishes subjective estimates of total system 
reliability. Neither architectural characteristic should 
enable single-channel interaction at the pilot vehicle 
interface during redundant channel operation. 


Single Failure Propagation in Redundant Systems 

A fourth issue, which is tangentially related to the 
characteristic discussed above, expands the fidelity of the 
interface between redundant core elements of the system and 
simplex peripheral components such as avionics. The 
AFTl/F-16 aircraft shares common trends in system design 
where the critical core elements are replicated in order to 
render sufficient reliability. The triplex flight control 
computers represent such strategy. A significant develop- 
ment to note, however, is that the redundant set of pro- 
cessors is embedded in a set of simplex units, such as the 
fire control or air data computer. Similarly, although the 
stores management computer is partially dual redundant , the 
protocol for switching between redundant halves frequently 
failed to take advantage of that capability and simplex 
failures were propagated. 

The interface between the redundant core of the triplex 
flight control computers in the AFTl/F-16 aircraft must be 
meticulously delineated, documented, and understood so that 
failures in the simplex subset of the system are not une- 
quivocably accepted and replicated by the redundant subset 
of the system. The authority and criticality of simplex 
inputs to the integarated system are substantial in the 
AFTl/F-16 and will probably increase in the future. 

The AFTl/F-16 aircraft experienced a failure in the 
stores computer, which exemplifies the subtle but critical 
value of the interface between the redundant core and the 
simplex (in this case, the duplex that failed to use its 
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redundancy) subset of the total AFTl/F-16 system. Func- 
tioning as a bus controller for the bus conveying flight 
control mode requests to the flight control mode requests. 

In less than 3 min, the AFTl/F-16 changed flight control 
modes more than 800 times! The flight control computers 
received control mode change requests from a simplex bus 
controller that appeared to function as a random-number 
generator. The flight control computer changed control 
modes whenever it received an actual mode request. The 
unscrutinized replication of a simplex input as critical as 
flight control mode lead to a rather dramatic breakdown of 
reliability in the redundant subset of the AFTl/F-16 system. 

Analysis of this type of failure suggests that responsi- 
bility for assessing the validity of simplex data resides 
in the redundant subset, not the generating single-string 
component. Generally, the complex fault-detection logic is 
already resident in the redundant subset. Although dupli- 
cate information will not be available for fault detection, 
resonability checks can still be executed on simplex data. 
Since failure-detection algorithms typically reside in the 
redundant set, it seems consistent to include simplex data 
inputs in these kinds of data validity certifications. 

The redundant subset responsibilities for operand vali- 
dity follow from a second architectural characteristic in 
that the level of sophistication in failure-detection 
algorithms should be appropriate to the criticality of the 
data. Data criticality is defined by system use and 
generally cannot be determined prior to system definition. 
Frequently, an avionics system is an operational unit and is 
not susceptible to modification of the failure-detection 
algorithms because the data are to be used in a more criti- 
cal function than intended when the unit was fabricated. 
Additionally, loading such failure detection in the redun- 
dant subset provides the same fault tolerance to hardware 
failures that is provided to other replicated processes. 

The final point to be made in this context is that test- 
ing should especially emphasize the redundant simplex inter- 
face. Once signal-string component errors propagate across 
the redundant core boundary, their effects become more insid- 
ious, because redundancy no longer covers their effects. 
Understanding failure propagation behavior across the redun- 
dant simplex interface is roughly equivalent to single-point 
failure analysis and shares much of its importance. 


CONCLUSIONS 


The capability for improved mission effectiveness 
becomes ever more critical as enemy threat capabilities 
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increase. Improvements can be attained by providing the 
pilot with the best flight control laws for the task at 
hand. This was demonstrated in the AFTl/F-16 aircraft using 
a multimode digital flight control system designed to opti- 
mize handling qualities for individual mission tasks. With- 
out task-dedicated control law design, the full benefit of 
control law tailoring could not have been realized. This 
strongly suggests the need for multiple flight control mode 
capablity in future mulitrole fighter aircraft. 

Direct side force with zero sideslip has been isolated 
as a decoupled motion which promises to significantly ' 
improve air-to-ground mission performance. Its implemen- 
tation on conventional rudder pedals, even with limited 
authority, can offer pilots a simple, intuitive initiation 
to an easier way to solve the directional problem in bombing 
and strafing. 

As the systems management function becomes a larger por- 
tion of the piloting task, improvements must be made in the 
management tools. Integrated avionics must include effi-' 
cient and comprehensive pilot displays and system controls, 
including multiple display units with well integrated 
display symbologies and methods for display of head-up 
information over a wider field of view. 

Voice command systems offer potential for reducing the 
pilot's workload with "hands-on” control of a variety of 
onboard systems from transducer codes to flight control 
modes. Further implementation of onboard synthesized voice 
and interactive operation may allow head-out access to cri- 
tical information not displayed visually. Carefully con- 
ceived voice systems may help to contain increases in 
cockpit workload as avionics subsystems become increasingly 
complex . 

Each of the four design ramifications discussed in this 
paper isolates an independent aspect of vehicles such as the 
AFTl/F-16. Our experiences have suggested higher penalties 
associated with failure to cover transitions to degraded 
mode flight. The costs of simplicity for a highly augmented 
vehicle are outstripped by costs of aircraft requirements 
for envelope limiting during the transition to degraded 
flight control. It is more important to provide envelope 
protection during transition than to constrain the backup 
system to be the simplest system that allows aircraft reco- 
very. Aircraft control deteriorates so rapidly with 
unstable airframes that the advantages of backup simplicity 
are quickly overshadowed by risks of aircraft loss or severe 
operational constraints imposed to enable safe transition to 
backup . 

The complex nature of the AFTl/F-16 cockpit suggests 
rather fundamental constraints that may imply architetures 
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as radical as admitting expert systems to integrate the 
pilot-vehicle interface. 

The capability to degrade to the last good channel and 
asynchronous interchannel tracking suggest the advisability 
of suppressing simplex channel information while a redundant 
set remains functional. Just as the actual reliability of 
redundant set operation was improved by localized synchroni- 
zation, the user's perception of system reliability is 
improved by preventing single-channel interaction at the 
pi lot- vehicle interface during redundant set operation. 

The final issue discussed above suggests that regardless 
of information source, the redundant subset should logically 
be the location of information validity checks . Simplex 
error propagation across the redundant simplex interface 
should be emphasized during failure modes and effects 
testing . 

As user’s we have been exposed to several interesting 
design ramifications that suggest basic constraints that may 
be useful for future design efforts. 
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Table 1. Task-tailored flight modes, including decoupled 
motion (six degrees of freedom). 


Standard modes 


Decoupled modes 


Normal 

SNRM 

g command 

DNRM 

FPME 

Vertical translation 
Lateral translation 

Bombs 

SASB 

g command 
Flat turn 

DASB 

FPME 

Directional lift 
Flat turn 

Air-to-air guns 

SAAG 

Pitch-rate 
command 
Flat turn 

DAAG 

PRME 

Pitch pointing 
Yaw pointing 

Air-to-sur face guns 

SASG 

P itch-rate 
■ command 
Flat turn 

DASG 

PRME 

Pitch pointing 
Yaw pointing 


FPME Flightpath maneuver enchancement 
PRME Pitch-rate maneuver enchancement 


19 






Table 2. Decoupled Motion with Maximum Control Authorities. 
1-g flight, impurities included. 




Flight 

Conditions 

Motion 

Authority 

Airspeed 

Altitude 



( KCAS ) 

(ft) 

Flat 

Lateral g 0.90 g 

500 

10,000 

turn 

Yaw rate 7.0 Deg 
(122.2 Mils/s 



Direct 

Normal g -1.7 g 

480 

9, 500 

lift 

Pitch rate 2.2 
Deg/s/38.4 Mils/s 

440 

21,200 

Yaw 

Sideslip 9.0 



pointing 

Deg/157.1 Mils 
Yaw rate 9.0 

277 

20, 200 


Deg/s/157.1 Mils/s 

220 

30, 500 

Pitch 

AAOA 8.0 Deg 



pointing 

(139.6 Mils) 
Pitch rate -4.9 

240 

31, 500 


Deg/s/-85.5 Mils 

450 

21,000 

Lateral 

Lateral g 0.95 g 
Lateral velocity 38.3 

480 

20, 500 


knots 

400 

9,000 

Vertical 

Normal g -1.10 g 
Vertical velocity 

480 

20, 500 


-25.1 knots 

360 

10, 200 
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Table 3. 


DFSC Inflight fault detection. 


38 fault declarations 
Hardware 

Switch — 17 

Other a/c systems — 8 

Software 

Design and mechanization — 10 
Unknown Cause 

Pilot procedures 

Deselection of g-bias — 1 

2 fault declarations not resetable inflight. 


Decoupled flight control modes 



Fig . 1 


Control surfaces producing decoupled motions 






Direct lift 

• Vertical flight path control 
at constant angle of attack 




Pitch pointing 
• Pitch attitude control at 
constant flight path angle 



Vertical translation 
• Vertical velocity control at 
constant pitch attitude 



Fig. 2. Vertical decoupled motions. Thottle twist 
controller . 


Direct sideforce (flat turn) 

• Directional flightpath control 
at zero sideslip angle 



—44 


Yaw pointing 

• Directional altitude control at 
constant flightpath angle 


Lateral translation 
• Lateral velocity control at 
constant yaw attitude 



— ¥ 


Fig • 3. Directional decoupled motions • Conventional rudder 

pedals • 
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• F-16 limits (9g, 25° AOA, etc.) 

• Decoupled operations to 6g 


(release pedal for max roll) 
• DNRM more restricted 



Mach 


Fig. 4. Flight envelopes for air-to-air modes. 


• F-16 limits (9g, 25° AOA, etc.) 

• Decoupled operations to 6g 

(release pedal for max roll) 

• Combined decoupled 

operations to 4g 
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Fig. 6. Digital flight control system 
software control — software release summary • 


Noise levels for flight test conditions. 


Altitude/Airspeed 

Environmental 
Control Setting 

Sound 

Pressure Level 

30K ft 

304 KIAS 

Auto cool 
Manual hot 

96dB 

lOOdB 

20K ft 

374 KIAS 

Auto cool 
Manual hot 

99dB 

103dB 

10K ft 

448 KIAS 

Auto cool 
Manual hot 

lOOdB 

108dB 

5K ft 

488 KIAS 

Auto cool 
Manual hot 

105dB 

IIOdB 
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Fig • 7. Voice command system — noise 

levels for flight test conditions . 
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(a) Original configuration . 

Fig. 10 . Independent backup unit. 
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Fig . 10 concluded • 
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